libext2fs: fix memory and fd leak in error path of unix_open()

Fix a potential memory leak reported by Li Xi.  In addition, there
were possible error cases where the file descriptor would not be
properly closed, so fix those as well while we're at it.

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reported-by:  Li Xi <pkuelelixi@gmail.com>

diff --git a/lib/ext2fs/unix_io.c b/lib/ext2fs/unix_io.c
index 02570f00818008f0a756599c035946e6c1b134fb..73716546a6687018fb870cd58b2a95420b6d3a87 100644 (file)
--- a/lib/ext2fs/unix_io.c
+++ b/lib/ext2fs/unix_io.c
@@ -505,6 +505,7 @@ static errcode_t unix_open(const char *name, int flags, io_channel *channel)
        memset(data, 0, sizeof(struct unix_private_data));
        data->magic = EXT2_ET_MAGIC_UNIX_IO_CHANNEL;
        data->io_stats.num_fields = 2;
+       data->dev = -1;
 
        open_flags = (flags & IO_FLAG_RW) ? O_RDWR : O_RDONLY;
        if (flags & IO_FLAG_EXCLUSIVE)
@@ -575,7 +576,6 @@ static errcode_t unix_open(const char *name, int flags, io_channel *channel)
                /* Is the block device actually writable? */
                error = ioctl(data->dev, BLKROGET, &readonly);
                if (!error && readonly) {
-                       close(data->dev);
                        retval = EPERM;
                        goto cleanup;
                }
@@ -621,11 +621,17 @@ static errcode_t unix_open(const char *name, int flags, io_channel *channel)
 
 cleanup:
        if (data) {
+               if (data->dev >= 0)
+                       close(data->dev);
                free_cache(data);
                ext2fs_free_mem(&data);
        }
-       if (io)
+       if (io) {
+               if (io->name) {
+                       ext2fs_free_mem(&io->name);
+               }
                ext2fs_free_mem(&io);
+       }
        return retval;
 }